Re: [Caml-list] OcamlSpread 0.0.1 released

Re: [Caml-list] OcamlSpread 0.0.1 released

[Ohad Rodeh]

Just to let you know that there is a Group-Communication system written
natively in Caml:
Ensemble. www.cs.cornell.edu/Info/Projects/Ensemble. The latests release
(1.38) is
dated a month ago.

      Ohad.
-----------------------------------------------------------------------------------

Ohad Rodeh
tel: +972-3-6401641
IBM Haifa, storage research


                                                                                                                                
                      "Yurii A. Rashkovskii"                                                                                    
                      <yrashk@openeas.org>          To:       caml-list@inria.fr                                                
                      Sent by:                      cc:       hump@pauillac.inria.fr                                            
                      owner-caml-list@pauill        Subject:  [Caml-list] OcamlSpread 0.0.1 released                            
                      ac.inria.fr                                                                                               
                                                                                                                                
                                                                                                                                
                      17/09/2002 04:15                                                                                          
                      Please respond to                                                                                         
                      "Yurii A. Rashkovskii"                                                                                    
                                                                                                                                
                                                                                                                                




OcamlSpread, a wrapper for a Spread (http://www.spread.org/) group
communication toolkit has a first release today.

It is quite inmature (it doesn't implement all of the kinds of
functions provided by Spread now) and probably has a couple of bugs.

At this moment OcamlSpread is distributed under the terms of GNU GPL
but will be GNU LGPL later (with notice of Spread license, too)

WARNING: This release should not be used in production.

BTW, I don't spend a lot of time to code it now (last change was about
a month ago) so contributors and/or new maintainer are welcome.

Homepage URL: http://ocamlspread.sourceforge.net/


--
Best regards,
 Yurii                          mailto:yrashk@openeas.org


-------------------
To unsubscribe, mail caml-list-request@inria.fr Archives:
http://caml.inria.fr
Bug reports: http://caml.inria.fr/bin/caml-bugs FAQ:
http://caml.inria.fr/FAQ/
Beginner's list: http://groups.yahoo.com/group/ocaml_beginners




-------------------
To unsubscribe, mail caml-list-request@inria.fr Archives: http://caml.inria.fr
Bug reports: http://caml.inria.fr/bin/caml-bugs FAQ: http://caml.inria.fr/FAQ/
Beginner's list: http://groups.yahoo.com/group/ocaml_beginners

Re[2]: [Caml-list] OcamlSpread 0.0.1 released

[Yurii A. Rashkovskii]

Hello Ohad,

Tuesday, September 17, 2002, 11:06:24 PM, you wrote:


OR> Just to let you know that there is a Group-Communication system written
OR> natively in Caml:
OR> Ensemble. www.cs.cornell.edu/Info/Projects/Ensemble. The latests release
OR> (1.38) is
OR> dated a month ago.

I know about Ensemble, and even use it now. OcamlSpread was an old
library and I just decided to release it to public (may be somebody
will need it :-) )

-- 
Best regards,
 Yurii                            mailto:yrashk@openeas.org


-------------------
To unsubscribe, mail caml-list-request@inria.fr Archives: http://caml.inria.fr
Bug reports: http://caml.inria.fr/bin/caml-bugs FAQ: http://caml.inria.fr/FAQ/
Beginner's list: http://groups.yahoo.com/group/ocaml_beginners

Re: [Caml-list] OcamlSpread 0.0.1 released

[Arnaud SAHUGUET]

[-- Attachment #1: Type: text/plain, Size: 799 bytes --]

Re: [Caml-list] OcamlSpread 0.0.1 releasedImplementing crypto packages is a real pain.
I wrote an implementation of DES in Java in 1996. Absolutely not interesting for me.

For this kind of stuff, I think writing an oCaml wrapper on top of C library is better.


>
More seriously, perhaps, a well-known source of flaws is complexity. 
Expressing algorithms in Ocaml is often (much) less complex than 
in C... 

-- That's probably true for public key cryptography. For symmetric key crypto and hash function, the algorithms are not elegant.

In companies, there is always the dilemma: make vs buy.
I think the oCaml community should think about "re-implement vs wrap". I don't think the real value of oCaml programming sits at the level of the OS or the low-level libraries.

Arnaud

[-- Attachment #2: Type: text/html, Size: 1739 bytes --]

Re: [Caml-list] OcamlSpread 0.0.1 released

[MONIN Jean-Francois FTRD/DTL/LAN]

[-- Attachment #1: Type: text/plain, Size: 1178 bytes --]

On a first reading I tended to agree with some
of your arguments. However:

> When choosing a crypto package, there are a few points to consider:
> [...]
> - the maintenance of the package
> Flaws are being discovered everyday. It is better to use a crypto
package
> which is widely used, tested and maintained.
> [...]
> I think the last and worst thing to do is to re-implement some crypto
from
> scratch.

But what do you think of:

"When choosing an operating system, there are a few points to consider:
[...]
- the maintenance of the OS
Flaws are being discovered everyday. It is better to use an OS
which is widely used, tested and maintained.
[...]
I think the last and worst thing to do is to re-implement some OS from
scratch."

More seriously, perhaps, a well-known source of flaws is complexity.
Expressing algorithms in Ocaml is often (much) less complex than 
in C...

I cannot be more specific in this case, because I did not examine
the implementations. However, as you say yourself:

> When choosing a crypto package, there are a few points to consider:
> 
> - the people who implement the package

Regards,
  Jean-Francois

[-- Attachment #2: Type: text/html, Size: 2354 bytes --]

Re: [Caml-list] OcamlSpread 0.0.1 released

[Arnaud SAHUGUET]

When choosing a crypto package, there are a few points to consider:

- the people who implement the package
(Good) crypto algorithms are usually secure on paper. But when translated in
code, this is not always the case.

- the range of algorithms supported
Actually this is not so critical because most protocol start with a
negociation phase.

- the maintenance of the package
Flaws are being discovered everyday. It is better to use a crypto package
which is widely used, tested and maintained.

- the license

openSSL seems to be a really good contender. Sun announced yesterday that it
is donated its Elliptic Curve crypto implementation (ECC)  to the project.
That's really for embedded devices because ECC offers the same level of
security with much smaller key size.

I think the last and worst thing to do is to re-implement some crypto from
scratch.

regards,

Arnaud

----- Original Message -----
From: "Xavier Leroy" <xavier.leroy@inria.fr>
To: "Yurii A. Rashkovskii" <yrashk@openeas.org>
Cc: "Ohad Rodeh" <ORODEH@il.ibm.com>; <caml-list@inria.fr>
Sent: Friday, September 20, 2002 9:15 AM
Subject: Re: [Caml-list] OcamlSpread 0.0.1 released


> > The question is not a speed, but strength of the algorithms. I think
> > that Ensemble *should* have storng algorithms for security or
> > pluggable interface to switch in OpenSSL, cryptokit or whatsoever.
>
> As Ohad said, OpenSSL offers more ciphers than my Cryptokit, and some
> of them probably run faster in OpenSSL, but still the ciphers and
> hashes supported by Cryptokit are entirely standard (AES, Triple DES,
> RC4, RSA, etc) and have no known cryptographic weaknesses -- provided
> adequate key sizes are selected, of course.
>
> Security holes are much more likely to arise as a consequence of
> incorrect use of these algorithms, e.g. at the cryptographic protocol
> level, than as a consequence of a weakness of the algorithms
> themselves.
>
> - Xavier Leroy
> -------------------
> To unsubscribe, mail caml-list-request@inria.fr Archives:
http://caml.inria.fr
> Bug reports: http://caml.inria.fr/bin/caml-bugs FAQ:
http://caml.inria.fr/FAQ/
> Beginner's list: http://groups.yahoo.com/group/ocaml_beginners
>

-------------------
To unsubscribe, mail caml-list-request@inria.fr Archives: http://caml.inria.fr
Bug reports: http://caml.inria.fr/bin/caml-bugs FAQ: http://caml.inria.fr/FAQ/
Beginner's list: http://groups.yahoo.com/group/ocaml_beginners

Re: [Caml-list] OcamlSpread 0.0.1 released

[Xavier Leroy]

> The question is not a speed, but strength of the algorithms. I think
> that Ensemble *should* have storng algorithms for security or
> pluggable interface to switch in OpenSSL, cryptokit or whatsoever.

As Ohad said, OpenSSL offers more ciphers than my Cryptokit, and some
of them probably run faster in OpenSSL, but still the ciphers and
hashes supported by Cryptokit are entirely standard (AES, Triple DES,
RC4, RSA, etc) and have no known cryptographic weaknesses -- provided
adequate key sizes are selected, of course.

Security holes are much more likely to arise as a consequence of
incorrect use of these algorithms, e.g. at the cryptographic protocol
level, than as a consequence of a weakness of the algorithms
themselves.

- Xavier Leroy
-------------------
To unsubscribe, mail caml-list-request@inria.fr Archives: http://caml.inria.fr
Bug reports: http://caml.inria.fr/bin/caml-bugs FAQ: http://caml.inria.fr/FAQ/
Beginner's list: http://groups.yahoo.com/group/ocaml_beginners

Re: [Caml-list] OcamlSpread 0.0.1 released

[Blair Zajac]

Hi,

I would be interested in hearing this discussion, so if it's
taken off list, then please cc me.

Thanks,
Blair

-- 
Blair Zajac <blair@orcaware.com>
Web and OS performance plots - http://www.orcaware.com/orca/

Ohad Rodeh wrote:
> 
> Ok,
>   Sounds like it would be better to take this off the caml-list, it is
> becoming
> Ensemble specific. Why don't you send me the exact weakness that you think
> may be harmful to your project, and I'll try to answer.
> 
>       Ohad.
> 
> -----------------------------------------------------------------------------------
> 
> Ohad Rodeh
> tel: +972-3-6401641
> IBM Haifa, storage research
> 
> 
>                       "Yurii A.
>                       Rashkovskii"             To:       Ohad Rodeh/Haifa/IBM@IBMIL
>                       <yrashk@openeas.o        cc:       caml-list@inria.fr
>                       rg>                      Subject:  Re[6]: [Caml-list] OcamlSpread 0.0.1 released
> 
>                       18/09/2002 10:59
>                       Please respond to
>                       "Yurii A.
>                       Rashkovskii"
> 
> 
> 
> Hello Ohad,
> 
> Wednesday, September 18, 2002, 7:56:09 PM, you wrote:
> 
> OR> For Ensemble, or that I need is the symmetric encryption and
> OR> Diffie-Hellman. It is possible
> OR> that OpenSSL has a faster implementation of Diffie-Hellman, but as long
> as
> OR> the difference
> OR> is not too great, I'd rather use an OCaml library.
> 
> The question is not a speed, but strength of the algorithms. I think
> that Ensemble *should* have storng algorithms for security or
> pluggable interface to switch in OpenSSL, cryptokit or whatsoever.
> 
> I'm developing an enterprise-level application in OCaml using Ensemble
> and security is a thing that should be quite strong :)
> 
> --
> Best regards,
>  Yurii                            mailto:yrashk@openeas.org
-------------------
To unsubscribe, mail caml-list-request@inria.fr Archives: http://caml.inria.fr
Bug reports: http://caml.inria.fr/bin/caml-bugs FAQ: http://caml.inria.fr/FAQ/
Beginner's list: http://groups.yahoo.com/group/ocaml_beginners

[Caml-list] OcamlSpread 0.0.1 released

[Yurii A. Rashkovskii]

OcamlSpread, a wrapper for a Spread (http://www.spread.org/) group
communication toolkit has a first release today.

It is quite inmature (it doesn't implement all of the kinds of
functions provided by Spread now) and probably has a couple of bugs.

At this moment OcamlSpread is distributed under the terms of GNU GPL
but will be GNU LGPL later (with notice of Spread license, too)

WARNING: This release should not be used in production.

BTW, I don't spend a lot of time to code it now (last change was about
a month ago) so contributors and/or new maintainer are welcome.

Homepage URL: http://ocamlspread.sourceforge.net/


-- 
Best regards,
 Yurii                          mailto:yrashk@openeas.org


-------------------
To unsubscribe, mail caml-list-request@inria.fr Archives: http://caml.inria.fr
Bug reports: http://caml.inria.fr/bin/caml-bugs FAQ: http://caml.inria.fr/FAQ/
Beginner's list: http://groups.yahoo.com/group/ocaml_beginners